<html>
<head><meta charset="utf-8"><title>Muckable Pitfall - Encapsulation Redundancy Risks · project-safe-transmute · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/index.html">project-safe-transmute</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Muckable.20Pitfall.20-.20Encapsulation.20Redundancy.20Risks.html">Muckable Pitfall - Encapsulation Redundancy Risks</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="218330313"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Muckable%20Pitfall%20-%20Encapsulation%20Redundancy%20Risks/near/218330313" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Muckable.20Pitfall.20-.20Encapsulation.20Redundancy.20Risks.html#218330313">(Nov 30 2020 at 19:03)</a>:</h4>
<p>Rust <em>already</em> has a mechanism for indicating that a field can be safely fiddled with: <em>visibility</em>.</p>
<p>Rust has a <a href="https://doc.rust-lang.org/reference/visibility-and-privacy.html">really rich visibility grammar</a> for both types and fields. Leveraging this grammar effectively is essential to building safe abstractions. Introducing a trait that <em>also</em> signals field visibility for a type when implemented is at best redundant, and at worst dangerous.</p>
<p>The visibility rules that govern a <code>Muckable</code> implemenation are counter to the visibility rules that matter for transmutation safety. An implementation of <code>Muckable</code> inherits the visibility of the implemented type. In contrast, the safety of a transmutation depends on the visibility of that type's <em>fields</em>.</p>
<p>In the everything's-public case, this mismatch isn't important. However, when the visibility of the type doesn't match the fields, it's crucial. Type authors must audit <em>both</em> their field visibility, <em>and</em> the visibility of their implementations of <code>Muckable</code> to ensure safety. Inadvertently leaking a <code>Muckable</code> implementation breaks all encapsulation for that type.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>